GitGuardian Report Finds 10 Million Secrets Exposed in Public GitHub Repositories in 2022
Summary
A webinar presenting GitGuardian’s 2022 report says it found 10 million secrets in public GitHub repositories, up about 67% year over year. Speakers discuss how exposed credentials are used and ways to prevent and remediate leaks.
Key points
- GitGuardian says it scanned more than 1 billion public GitHub commits in 2022 and found 10 million secrets, compared with 6 million the previous year; scanned commit volume rose about 20%.
- The presentation says about 5.5 commits per 1,000 exposed at least one secret, a roughly 50% increase on a comparable basis.
- Storage keys were the most common secret type, followed by cloud-provider keys, messaging-system credentials, and private keys. Environment files were the most common file source identified.
- GitGuardian speakers recommended secret scanning before code is committed, developer education, and organization-wide remediation to remove exposed secrets from codebases.
- Speakers also discussed using short-lived or dynamically rotated credentials and secret managers, while warning that poorly configured secret managers can themselves expose credentials.
- A penetration tester described examples in which exposed Slack credentials enabled access to messages and exposed configuration or SSH keys provided access to systems.
Article Details
- Publisher
- DarkOwl.com (Blog)
- Report Period
- 2022
- Scope
- GitGuardian findings on secrets exposed in public GitHub commits, with discussion of secrets on darknet and deep-web sources.
- Sample Size
- More than 1 billion public GitHub commits scanned during 2022.
- Key Statistics
- GitGuardian reported finding 10 million secrets in public GitHub during 2022, about 67% more than the 6 million reported for the previous year.
- About 5.5 commits per 1,000 exposed at least one secret; the speakers said this rate increased by about 50% year over year.
- The speakers reported that roughly 1 in 10 of the 13 million unique authors who publicly committed code in 2022 exposed secrets.
- GitGuardian reported finding more than 3,000 ChatGPT-related API keys per week, compared with about 100 per week in early 2022.
- DarkOwl's speaker reported that its database contained 9.4 billion credentials, 5 billion of them associated with passwords.
- Recommendations
- Use shift-left and pre-commit controls to prevent secrets from entering code repositories.
- Educate developers about preventing secret exposure.
- Remove historical secrets from code and remediate exposures at scale.
- Use dynamic key rotation and short-lived tokens where applicable.
- Secure secrets-manager implementations, including keeping root keys out of environment variables.
People
Eric FourrierGitGuardian CEO and Co-founder; discussed the report's findings and secret detection and remediation.Mackenzie JacksonGitGuardian Security Advocate and webinar moderator presenting findings from the State of Secrets Sprawl report.Mark TurnageDarkOwl CEO and Co-founder; discussed darknet data and credential exposure.Philippe CaturegliNetragard Chief Hacking Officer; described penetration-testing examples involving exposed secrets.
Vendors
Amazon Web ServicesSo a specific detector is like for a cloud provider would be like AWS GCP.DarkOwlat GitGuardian, Eric Fourrier, Co-founder and CEO of GitGuardian, Mark Turnage, Co-founder and CEO of DarkOwl, and Philippe Caturegli, Chief Hacking Officer of Netragard, dive into the leaks in public GitHub repos,GitGuardianIn 2022, GitGuardian scanned a staggering 1.027 billion GitHub commits!GoogleAnd if we are looking at unique detectors, the number one detector that we find is the Google API keys.Microsoft AzureBut like native integration, we still have all the VCS or GitLab, Azure, DevOps, and GI buckets.NetragardMark Turnage, Co-founder and CEO of DarkOwl, and Philippe Caturegli, Chief Hacking Officer of Netragard, dive into the leaks in public GitHub repos, trends such as Infrastructure-as-Code, AI/ChatGPT mentions,SlackSo I think it’s amazing to see that in a lot of the past leaks; Okta, I should look at Okta, Slack and all the ones that are in the report, it’s at some point, it’s secret is not the starting point of the attack, but at
Products
DarkOwlat GitGuardian, Eric Fourrier, Co-founder and CEO of GitGuardian, Mark Turnage, Co-founder and CEO of DarkOwl, and Philippe Caturegli, Chief Hacking Officer of Netragard, dive into the leaks in public GitHub repos,GitGuardianIn 2022, GitGuardian scanned a staggering 1.027 billion GitHub commits!GitHubIn 2022, GitGuardian scanned a staggering 1.027 billion GitHub commits!SlackSo I think it’s amazing to see that in a lot of the past leaks; Okta, I should look at Okta, Slack and all the ones that are in the report, it’s at some point, it’s secret is not the starting point of the attack, but atTelegramThe most active of those right now is Telegram.VaultSo, I will say API keys and Sequel 12, you have the rise of sequence managers, like Vault are trying to push protectionary measures such as dynamic key rotation, which are great.